The policy has a directive that CSP Level 3 does not define.

CSP_UNKNOWN_DIRECTIVE · Severity: Info

• InfoCSP_UNKNOWN_DIRECTIVE

  The policy has a directive that CSP Level 3 does not define.

  Browsers ignore directives they do not know, so a typing error such as scirpt-src silently leaves that part of the policy out. The evidence names the directive.

  Recommendation: Check the spelling of the directive named in the evidence.

Reported by

• CSP header parser

Available through the API

• CSP header parser API

Related findings

• Info CSP_UNSAFE_INLINE The Content Security Policy allows inline or eval'd scripts.
• Info CSP_DEPRECATED_DIRECTIVE The policy uses a directive that has been removed from CSP.
• Warning CSP_DUPLICATE_DIRECTIVE A directive appears twice in one policy, and browsers ignore the second one.
• Error CSP_EMPTY_POLICY The pasted Content-Security-Policy has no directives.
• Info CSP_MISSING The HTTPS site sends no Content-Security-Policy header.
• Info CSP_NO_BASE_URI The policy does not restrict the base element (base-uri).

All findings